LangGraph vs AI SDK

LangGraph 60

The library sends nothing according to the data-storage page, re-read on 1 November. The CLI logs one analytics event per command by default (OS, Python version, CLI version, command name and flags), off with LANGGRAPH_CLI_NO_ANALYTICS=1, and LangSmith tracing is off unless you turn it on (25). Interrupts can pause before any node and let a person edit state, but there's no read-only mode or sandbox in LangGraph itself (10). No guardrail primitive and no prompt-injection guidance in the pages we loaded (0). LangSmith tracing, opt-in (10). LangChain's organisation SECURITY.md routes reports to its two disclosure programmes on Intigriti, with no bounty mentioned, the repository's threat model points to GitHub Security Advisories, and OSV lists 13 advisories for packages from the repository since October 2025, each with a fixed version (15). Framework reading, so SOC 2 isn't scored.

AI SDK 90

No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.

LangGraph 70

No MCP client in LangGraph. It comes from LangChain's langchain.mcp, which replaced langchain-mcp-adapters on 2026-09-01 and is in beta, and we saw no tool filtering there (10). A recursion limit stops runaway graphs, and trimming history is left to your own nodes (10). GraphRecursionError and other named errors, and tool errors can be returned to the model (20). Per-node retry policies and checkpointed resume (20). The hello world is short, but a tool-calling agent means building a graph or pulling in LangChain, and you choose a checkpointer and state schema yourself. Python and TypeScript (10).

AI SDK 95

An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).

LangGraph 75

Official packages on PyPI (Requires-Python >=3.10 in the pyproject at 1.2.19) and npm (node >=18, per the 1 October check) (20). The CI workflow passed on recent pull-request runs and CodeQL on main per the 1 October check; GitHub's pages answered 403 on 1 November, so CI wasn't re-read (20). 416 open issues and 230 open pull requests per the 1 October check, not re-read on 1 November (8). Seven 1.2.x patch releases since 1.2.12 with conventional commit messages, but 1.2.18 (26 October) carries a commit marked breaking (feat(langgraph)!, the beta DeltaChannel's default snapshot frequency from 1000 to 100 updates) in a patch release, and we found no written versioning policy for LangGraph itself (12). 1.2.19, classed 5 - Production/Stable (15).

AI SDK 93

Official npm packages, with ai 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.

LangGraph 89

A typed graph API with a reference site (25). llms.txt at docs.langchain.com, per the listing's earlier check (10). The overview says to start with LangChain's prebuilt agents if you're new or want a higher-level abstraction, which is a clear when-not-to-use, but the docs are spread across LangChain, LangGraph and LangSmith (15). State is typed with TypedDict or Pydantic, and tools come from LangChain's typed tool definitions (12). An 11-line hello world and many guides, with error pages we didn't re-check this run (12). Dated changelog (15).

AI SDK 100

Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).

LangGraph 81

MIT (30). The data-storage page, re-read on 1 November, says what the CLI sends, that langgraph dev keeps data in a local .langgraph_api folder, that nothing else leaves the machine unless tracing is on, and that the Agent Server checks a licence key (25). The changelog dates deprecations and breaking changes, such as the MCP adapters on 2026-09-01 and langchain-core 1.7.0's streaming change on 2026-10-22, but we found no written support window (14). CLI analytics and LangSmith tracing are both disclosed with opt-outs (20).

AI SDK 89

Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).

LangGraph 90

1.2.19 tagged on 2026-10-30 (30). Nine releases of the core package in the 90 days from 3 August, 1.2.11 (11 August) to 1.2.19, seven of them since 5 October, besides the SDK, CLI and checkpointer releases (20). 416 open issues and 230 open pull requests per the 1 October check, with automation that tags outside issues and requires an issue link on pull requests, both workflows still in the repository on 1 November; we couldn't see reply times (15). langgraph 1.2.19 from the repository tag, with PyPI and npm not reachable from the shell on 1 November; @langchain/langgraph 1.4.18 per the 1 October check (15). CI and CodeQL workflows present, pass state per the 1 October check (10).

AI SDK 97

7.0.163 on 2026-11-05 (30). 226 stable npm releases of ai across the 7.x, 6.x and 5.x lines in the 90 days to 6 November, 70 of them since 6 October (20). 47 of the 50 newest issues commented and 32 closed, with triage automation and backport workflows (22). ai and the provider packages are current, and 6.x and 5.x still get patches (15). Dependabot configured and CI passing on main (10). 30+20+22+15+10 = 97.